AI Governance and EU AI Act Alignment
This domain tests the EU AI Act's risk-based obligations and how to operationalise them through AI governance. Questions often turn on actor roles, system classification, timelines, evidence, and alignment with frameworks such as ISO/IEC 42001 and the NIST AI RMF. The Regulation is Regulation (EU) 2024/1689.
Risk tiers and roles
- Prohibited practices under Article 5 apply from 2 February 2025: social scoring, manipulative or exploitative techniques, untargeted facial scraping, certain biometric categorisation, emotion recognition in workplaces and education, and real-time remote biometric identification in public for law enforcement with narrow exceptions.
- High-risk systems are listed in Annex I (product safety) and Annex III (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice). Providers must meet Articles 8–15: risk management, data governance, technical documentation, logging, transparency and instructions, human oversight, accuracy, robustness and cybersecurity, plus a quality management system, conformity assessment, CE marking, registration, post-market monitoring and serious-incident reporting.
- Deployers must use systems per instructions, assign competent human oversight, ensure input data is relevant and sufficiently representative, keep logs at least six months, monitor, and inform affected persons. Public-authority deployers register and may need a fundamental rights impact assessment.
- Limited-risk systems trigger Article 50 transparency: disclose AI interaction, mark synthetic content, label deepfakes. Minimal-risk systems have no additional obligations.
- General-purpose AI: all providers need technical documentation, downstream information, a copyright policy and a training-content summary; systemic-risk models above 10^25 FLOPs add evaluation, adversarial testing, incident reporting and cybersecurity. GPAI rules apply from 2 August 2025; Commission enforcement from 2 August 2026.
Worked example
A company buys a SaaS CV-screening tool. The tool ranks candidates for recruitment, so it is Annex III point 4 employment, high-risk. The vendor is the provider and must operate a QMS, prepare technical documentation, complete conformity assessment (Annex VI internal control for most Annex III systems), CE-mark and register. The company is the deployer: it must follow instructions, assign a competent human overseer, ensure input data is relevant, monitor, retain logs at least six months, and inform workers and candidates. If the company is a public authority, it also registers and may need a fundamental rights impact assessment. The high-risk obligations apply from 2 August 2026.
Traps that cost marks
- Assuming every AI system needs conformity assessment; only high-risk systems do.
- Treating a vendor contract as transferring all deployer duties.
- Mixing provider and deployer. Rebranding, substantial modification or changing intended purpose can make a deployer a provider under Article 25.
- Using wrong dates: prohibitions 2025, GPAI 2025, Annex III high-risk 2026, Annex I high-risk 2027.
- Assuming a fundamental rights impact assessment applies to every high-risk deployer; it is limited.
- Assuming open-source GPAI is fully exempt; systemic-risk duties and copyright/training-summary duties remain.